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IN THE CLAIMS 

Please amend the claims as follows: 

Claims 1-7. (Canceled) 

8. (Currently Amended) A method implemented in a computer-readable medium and for 
executing on a proxy server the method for policy and attribute based access to a resource, 
comprising: 

receivin g, at the proxy server, a session request for access to a resource, wherein the 
session request is sent from a service and includes alias identity information for a principal, 
wherein the alias identity information includes a random password and a random principal 
identi lication , the alias identity information is randomly generated from identity information, the 
identity information identifies a true identity ("or the principal ; 

mapping , by the proxy server, the alias identity information to the identity information of 
the principal , the identity information associated with the true identity of the principal whereas 
the alias identity information is the random password and the random principal identi lication and 
the identity information and the true identity of the principal is available to the proxy server but 
not the service or the resource ; 

authenticating , by the proxy server, the identity information; 

acquirin g, by the proxy server, a service contract for the principal, the service, and the 
resource, wherein the service contract includes selective resource access policies and attributes 
which are permissibly used by the service on behalf of the principal; and 

establishing , by the proxy server, a session with the service, wherein the session is 
controlled by the service contract. 



9. (Currently Amended) The method of claim 8 further comprising accessin g, by the proxy 
server, an identity configuration for the principal in order to acquire the selective resource access 
policies and attributes included within the service contract. 
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10. (Currently Amended) The method of claim 8 further comprising denying , by the proxy 
sever, access attempts made by the service during the session when the access attempts are not 
included within the service contract. 

1 1 . (Currently Amended) The method of claim 8 further comprising terminatin g, by the 
proxy server, the session when an event is detected that indicates the service contract is 
compromised or has expired. 

12. (Currently Amended) The method of claim 8 further comprising establishing , by the 
proxy sever, the service contract with the principal prior to receiving the session request. 

13. (Currently Amended) The method of claim 12 further comprising reusing , by the proxy 
sever, the service contract to establish one or more additional sessions with the service, wherein 
the one or more additional sessions are associated with one or more additional session requests 
made by the service. 

14. (Original) The method of claim 12 wherein the establishing further includes establishing 
the service contract with the principal in response to a redirection operation performed by a 
proxy that intercepts a browser request issued from the principal to the service for purposes of 
accessing the resource. 

Claims 15-20. (Canceled) 

21 . (Currently Amended) A policy and attribute based resource session manager, residing in 
a computer-accessible medium and for executing on a proxy server, comprising instructions for 
establishing a session with a resource, the instructions when executed performing the method of: 
receivin g, at the proxy server, alias identity information from a service, wherein the alias 
identity information is associated with a principal, and wherein the alias identity information 
includes a random password and a random principal identificatio n, the alias identity information 
is randomly generated for principal identity information of the principal and the principal 
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identity information identifies a true identity of the principal ; 

requesting , by the proxy server, a mapping of the alias identity information to the 
principal identity information , the principal identity information associated with the true identity 
of the principal whereas the alias identity information is the random password and the random 
principal identification and the principal identity information and the true identity of the 
principal is available to the proxy server but not the service or the resource ; 

requesting , by the proxy server, authenticating of the identity information; 

requesting , by the proxy server, a service contract for the principal, the service and a 
resource, wherein the service contract includes selective resource access policies and attributes 
derived from an identity configuration; and 

establishing , by the proxy server, a session with the service and the resource, wherein the 
session is controlled by the service contract. 



22. (Currently Amended) The policy and attribute based resource session manager of claim 
21 having instructions further comprising, permittin g, at the proxy server, the service to 
indirectly access an identity store which represents the resource, and wherein the identity store 
includes secure information related to the principal. 

23. (Currently Amended) The policy and attribute based resource session manager of claim 
21 having instructions further comprising terminating , at the proxy server, the session when the 
service contract expires or is compromised. 

24. (Original) The policy and attribute based resource session manager of claim 21, wherein 
the requesting of the mapping further includes interacting with an alias translator. 

25. (Original) The policy and attribute based resource session manager of claim 21, wherein 
the requesting of authentication further includes interacting with an identification authenticator. 



26. (Currently Amended) The policy and attribute based resource session manager of claim 
21 having instructions further comprising managin g, at the proxy server, the session by acting as 
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an intermediary between the service and a legacy Lightweight Directory Access Protocol 
(LDAP) application which has access privileges to the resource. 



27. (Original) The policy and attribute based resource session manager of claim 26, wherein 
the receiving further includes intercepting a session request that is issued from the service for the 
legacy LDAP application, wherein the session request includes the alias identity information. 

28. (Currently Amended) The policy and attribute based resource session manager of claim 
27 having instructions further comprising managing , at the proxy server, the session with respect 
to the service as if the policy based resource session manager were the legacy LDAP application. 

29. (Original) The policy and attribute based resource session manager of claim 21 wherein 
the instructions for establishing the session further includes defining the selective resource access 
policies as at least one of a read operation and a write operation and defining the attributes as 
selective confidential data related to the principal, wherein the policies define operations that are 
permissible on the attributes, and wherein values for the attributes reside in the resource. 



